diff --git a/README.md b/README.md
index 891c203..9e7dc6f 100644
--- a/README.md
+++ b/README.md
@@ -201,6 +201,26 @@ docker compose -f docker-compose.webapp.yml up -d --build
 
 Binds to `127.0.0.1:8055`.
 
+### With Docker behind a reverse proxy
+
+Use the reverse-proxy compose file when another container, such as Caddy,
+owns the public ports and shares an external Docker network with the webapp.
+The file defaults that external network to `caddy`:
+
+```bash
+docker network create caddy
+docker compose -f docker-compose.webapp.proxy.yml up -d --build
+```
+
+This does not publish a host port. It exposes port `8055` only on the proxy
+network. For Caddy, a site block can reverse proxy to the webapp container:
+
+```caddyfile
+cbgpt.example.com {
+    reverse_proxy climbingboardgpt-webapp:8055
+}
+```
+
 ---
 
 ## CLI demos
@@ -387,6 +407,7 @@ ClimbingBoardGPT/
 ├── tests/            Unit tests
 ├── webapp/           FastAPI server + browser-side SVG route builder
 ├── docker-compose.webapp.yml
+├── docker-compose.webapp.proxy.yml
 ├── requirements.txt
 └── pyproject.toml
 ```
diff --git a/docker-compose.webapp.proxy.yml b/docker-compose.webapp.proxy.yml
new file mode 100644
index 0000000..52a972d
--- /dev/null
+++ b/docker-compose.webapp.proxy.yml
@@ -0,0 +1,24 @@
+services:
+  climbingboardgpt-webapp:
+    build:
+      context: .
+      dockerfile: webapp/Dockerfile
+    container_name: climbingboardgpt-webapp
+    restart: unless-stopped
+    expose:
+      - "8055"
+    environment:
+      CBGPT_DEVICE: "cpu"
+      CBGPT_TORCH_THREADS: "1"
+    volumes:
+      - ./models:/app/models:ro
+      - ./data/processed/tokenized:/app/data/processed/tokenized:ro
+      - ./images:/app/images:ro
+      - ./webapp:/app/webapp:ro
+    networks:
+      - proxy
+
+networks:
+  proxy:
+    external: true
+    name: caddy